18.1 Assessing New Products and Features Before Launch
Key Takeaways
FATF Recommendation 15 requires firms to assess ML/TF risks before launching new products, business practices, delivery mechanisms or technologies, and to manage those risks.
Moving from domestic to international payments adds sanctions, Travel Rule, corridor-risk and licensing considerations.
New distribution channels such as embedded-finance partners or agents add third-party, data-visibility and nested-customer risk.
A post-launch review at set intervals checks whether actual usage, alerts and losses match the pre-launch risk assessment.
CAFCA sub-topic 5.1 asks how to assess new products and additional features, their potential risks and the necessary controls. The outline names the elements that present particular risks: products moving from domestic to international, new types of accounts, changes to payment processes, and added distribution channels. Scaling FinTechs ship features constantly. Compliance has to be part of the product lifecycle, not a sign-off at the end.
The legal anchor
FATF Recommendation 15 requires countries and financial institutions to identify and assess the money laundering and terrorist financing risks that arise from new products and new business practices, including new delivery mechanisms and new or developing technologies. The assessment should take place before launch, and appropriate measures should manage and reduce the risks. National rules and supervisory guidance build on this, and partner banks usually require a formal approval.
A new product approval (NPA) process
| Stage | Financial crime activities |
|---|---|
| 1. Concept | Early compliance involvement: does the feature create a new regulated activity? Is a licence or partner approval needed (Chapter 3)? |
| 2. Risk assessment | Assess customers, geographies, features, channels and transaction characteristics (reversibility, convertibility, speed, anonymity). Rate inherent risk |
| 3. Control design | Map the controls: CDD level, screening points, monitoring scenarios and thresholds, limits and holds, fraud controls, reporting routes, MI |
| 4. Data and systems | Confirm that every new transaction type and field reaches screening and monitoring; update the data dictionary |
| 5. Testing | User acceptance testing that includes compliance cases, such as a test sanctions hit, a test alert and a test hold |
| 6. Approval | Sign-off by compliance or the MLRO, plus partner-bank approval where required; record residual risk against appetite |
| 7. Controlled launch | Pilot or phased rollout with customer caps and value limits |
| 8. Post-launch review | At, for example, 30, 90 and 180 days: compare actual usage, alerts, SARs and losses with assumptions; tune controls |
The four elements the outline highlights
| Change | New risks | Typical controls |
|---|---|---|
| Domestic to international (cross-border payouts, multi-currency, foreign customers) | Sanctions and high-risk corridors; Travel Rule data; correspondent and payout-partner risk; foreign licensing; FX-based layering | Multi-list screening; corridor risk ratings and limits; payout-partner due diligence; Travel Rule messaging; local licence analysis |
| New account types (business accounts, joint accounts, accounts for minors, multi-currency, crypto) | Beneficial ownership and KYB; legal capacity issues; different expected activity | Entity CDD and beneficial ownership; new risk-rating factors; new monitoring baselines |
| Changing payment processes (instant payouts, push-to-card, card loading, crypto withdrawals, removing holds) | Irreversible exits; rail arbitrage; shorter detection windows | Real-time screening; holds for reversible funding; velocity limits; pre-release fraud scoring |
| New distribution channels (embedded-finance partners, agents, affiliates, white-label, API access) | Less visibility of end customers; nested customers; partner misconduct; marketing that misrepresents | Partner due diligence; contract flow-down; data feeds; partner-level monitoring; marketing approval |
A one-page product risk summary
Many firms record the assessment on a short template that the approval committee can read in minutes:
| Field | Example entry |
|---|---|
| Feature | Instant payouts to debit cards in 5 countries |
| Who can use it | Verified customers with 30 days' tenure |
| Key risks | Fraud cash-out; mule networks; sanctions corridors |
| Controls | Screening before release; velocity limit; 24-hour hold after card loads; payout-partner due diligence |
| Data for monitoring | Card BIN country, payout amount, device ID |
| Residual risk vs appetite | Medium, within appetite after controls |
| Launch conditions | 10,000-customer pilot; daily cap per user |
| Review dates | 30, 90 and 180 days |
The template makes approvals consistent and gives auditors a clear trail from risk to control.
Questions that uncover hidden risk
- Who could abuse this feature, and how? Think about mules, scam victims, fraudsters and sanctions evaders.
- Does it allow value to leave faster, further or more anonymously than before?
- Does it allow third parties to fund or receive?
- Will monitoring see the transaction, and with what data?
- What happens if a control fails at three in the morning on a public holiday?
- Does any marketing language promise something the controls will block?
Realistic exam scenario
A neobank plans to add instant international payouts to 20 countries in eight weeks. The product team has already built the feature. Compliance is asked to "approve by Friday". The right response is to run the product risk assessment now. That covers corridor ratings, screening against all applicable lists, Travel Rule and partner requirements, licensing in the payout countries, monitoring ingestion and new scenarios, and limits. Then propose a phased launch, perhaps to five lower-risk corridors with value caps, while the remaining controls are completed. Approval without assessment, or a flat refusal, are both poor answers. The risk-based answer is a controlled launch.
Common exam traps
- Involving compliance only at the end of development.
- Assuming existing controls automatically cover a new feature.
- Skipping the post-launch review.
- Forgetting partner-bank approval and licensing checks.
According to FATF Recommendation 15, when should a financial institution assess the ML/TF risks of a new product or technology?
Within five years of launch, at the next full programme review
Only if the regulator specifically requests an assessment
Only after the first SAR has been filed on the product
Before launch, with measures to manage the risks found
A FinTech adds push-to-card instant withdrawals while still allowing deposits by card. Which new risk should the product assessment highlight?
Rail arbitrage: reversible card funding, irreversible fast exit
Elimination of chargeback risk on card deposits
Lower sanctions exposure because payouts go to cards
Reduced need for real-time transaction monitoring
Which approach to a high-risk feature request best reflects a risk-based new product process?
Reject all cross-border features permanently to avoid any new risk
Assess risks, map controls, then launch in phases with limits and a review
Approve immediately to meet the commercial deadline agreed with investors
Let the partner bank decide on its own without any FinTech assessment at all
Sections you finish are checked off in the contents.